Certain canvas operations in Mozilla Firefox can lead to memory corruption during the rendering of image data. The vulnerability arises when the browser attempts to write beyond allocated buffers, potentially allowing an attacker to overwrite process memory. While the description does not explicitly state the resulting payload, a memory corruption flaw of this nature is capable of enabling arbitrary code execution in the context of the browser. The weakness is classified as CWE‑787 and is rated with a CVSS score of 9.8, which reflects the potential for full compromise of the host system.

Mozilla Firefox, all releases prior to 139.0.4 are affected, as the fix was introduced in that version. No further version qualifiers are provided, so any build before the patch likely remains vulnerable.

The EPSS score for this vulnerability is below one percent, indicating that exploitation attempts are expected to be rare. The issue is not listed in the CISA KEV catalog. However, the CVSS score of 9.8 signals that an exploit, if discovered, could yield complete system compromise. The likely attack vector involves a malicious web page that manipulates canvas content, as the flaw is triggered during rendering. While exploitation probability is low, the high impact warrants prompt action.